As computerized systems have increased in popularity, so have the needs to distribute files and processing resources of computer systems in networks both large and small. In general, computer systems and related devices communicate information over networks for a variety of reasons, for example, to exchange electronic messages, sell merchandise, provide account information, and so forth. One will appreciate, however, that as computer systems and their related applications have become increasingly more sophisticated, the challenges associated with sharing data and resources (e.g., a “device,” “application,” or “application component”) on a network have also increased.
Some current ways for managing resources within a network include centralized computing scenarios, which can involve a centralized gateway server sharing resources with one or more clients that may not have those resources installed locally. One such example involves a centralized gateway server that allows a client computer system to login to the gateway server on a local intranet, or to login through a network firewall. The client computer can then access data and resources of interest through the firewall using a secure connection.
In one firewall example, the client computer system might tunnel through the firewall from a network layer at the client computer system to a corresponding network layer at the server computer system using a Virtual Private Network (“VPN”), Remote Access Server (“RAS”), or other type of firewall traversal connection. A tunneling firewall-traversal connection such as this generally involves a client using the Secure Hypertext Transfer Protocol (“HTTPS”), which is an HTTP mechanism that exchanges encrypted information using Secure Socket Layer (“SSL”) or Transport Layer Security (“TLS”) encryption mechanisms, to authenticate at a gateway server. After the gateway server allows passage through the firewall, the client computer system can then access all of the resources behind the firewall, such as by using one or more sockets to interact with a given resource.
With another firewall traversal solution, such as one that connects an application layer at the client with an application layer at the server, the client might also need to call out a protocol processor associated with the resource of interest. A protocol processor in this case is essentially an Application Program Interface (“API”), which is also typically designed as a plug-in (i.e., a “protocol processor plug-in”) to the RPC/HTTPS communication stack. In addition to being configured for communicating with a certain type of resource or application program, the protocol processor plug-in is also typically designed to include certain network policies for using the given resource (or application). Thus, upon logging in, and upon passing any required levels of authentication required by the protocol processor plug-in, the client computer system can exchange information with the requested resource at the server computer system. For example, the client may be able to send mouse and keyboard events, which are then relayed to an appropriate resource. The resource then processes those events, and returns the results of this processing to the client for local display.
Within a firewall, it is relatively easy to configure server and client computers to provide a client access to applications and data contained on a server. Protocols, which may not be resistant to attack if exposed to the Internet, can be utilized effectively in such an environment that is not exposed to the Internet. Such environments are typical of many corporate intranets. Unfortunately, such a configuration does not provide for utilization of server resources outside the firewall.
Exposing the server directly to the Internet is generally not an option since it would be vigorously attacked with potentially disastrous consequences. As a result, it is common for corporate employees to utilize VPN technology to traverse a firewall and access the server from remote sites, such as from home or travel. While VPN technology provides a workable solution in many applications, VPN connections are hard to setup and maintain and may expose the server to problems present on the connected computer.
A Terminal Server (“TS”) allows a remote client machine to access applications and resources on a server computer over a network. For example, Terminal Services is Microsoft's implementation of thin-client terminal server computing and allows a remote client machine to serve as a terminal emulator. A remote client machine may access Windows® applications and other resources of a computer running Terminal Services. The remote client may be running any operating system that supports the Terminal Services protocol. With Terminal Services, only the user interface is presented to the remote client. Input from the remote client, such as key presses and mouse clicks, is redirected over a network to the server. All application processing takes place on the computer. Applications are not downloaded or streamed to the remote client.
Software on the remote client manages the connection to Terminal Services. For example, Remote Desktop Connection software uses Remote Desktop Protocol (“RDP”) to communicate with Terminal Services. As another example, an ActiveX control may embed Terminal Services communication functionality in a client application or a web page.
When a remote client connects to a TS, a login subsystem authenticates the connecting user. A TS console session is spawned Keyboard, mouse, and graphic drivers are replaced with RDP-specific drivers. Keyboard and mouse inputs are received over the network and presented to the console session. Virtual channels that allow other devices, such as disk drives and printers, to be redirected may be opened. The RDP protocol mediates the transfer of data between the remote client and the TS in a manner that should be transparent to applications running on the TS.
A Terminal Services Gateway Server (“TSG”) provides a means to enable firewall traversal to provide access to a protected server or other intranet resources from clients outside the firewall. For example, RDP data may be tunneled through a firewall over a HTTPS channel. The TSG may provide for remote user authentication. The TSG may also mediate communication between the remote client and the TS.
An authentication factor is a piece of information and related process used to authenticate or verify a person's identity. Some examples of authentication factors are: a user password; a PIN; a smartcard; a biometric identifier (such as a fingerprint or retinal scan result); a security token; and a hardware device such as a USP token. Authentication factors are generally based on something a user knows (such as a password or PIN), something a user has (such as a smartcard or security token), or something the user is or does (such as a scanned fingerprint or voice identification). In some situations, a combination of security factors is used to provide enhanced security. For example, a bankcard and associated PIN are required to access most ATMs. Having a bankcard without the PIN or knowing the PIN without having the bankcard will generally not allow one to access a user's account on an ATM.